On Tue, 20 Feb 2024 11:29:53 -0500
Sean Anderson <sean.ander...@seco.com> wrote:
> On 2/20/24 04:50, Benjamin Lemouzy wrote:
> > Using fdtdump shows that crc32 is used as hash algorithm for FIT image
> > which is a super weak one.
> > I tried to pass another algo (sha256) using mkimage -o option but that
> > doesn't work.
> >
> > ./tools/mkimage -f auto -A arm -T firmware -C none -O u-boot -a
> > 0x17800000 -e 0x17800000 -p 0x0 -n "U-Boot
> > 2024.04-rc2-00025-g9e00b6993f-dirty for mx6sabresd board" -E -b
> > arch/arm/dts/imx6q-sabresd.dtb -b arch/arm/dts/imx6qp-sabresd.dtb -b
> > arch/arm/dts/imx6dl-sabresd.dtb -d u-boot-nodtb.bin -o sha256 u-boot-dtb.img
> >
> > Is there any way to change U-Boot FIT image hash?
>
> I believe these options are only used for signed FIT images (e.g. for
> verified boot [1]). Since you are using an external signing process,
> they have no effect. I suggest creating your FIT manually (e.g. -f
> u-boot.its instead of -f auto). You should be able to specify the hashes
> manually that way.
Using "fdtdump -s u-boot-dtb.img" output as reference to create a u-boot.its
file, I now have a u-boot.itb file with sha256 hashes.
> > I also try to use image format and force the HAB to verify the whole
> > u-boot-dtb.img file by patching the FIT image size:
> >
> > image_size=$(stat -tc %s u-boot-dtb.img)
> > printf "00000004: %08x" "$image_size" | xxd -r - u-boot-dtb.img
> >
> > SPL starts, authentication looks fine but the boot fails.
> > Is there any chance to make it work or is it insane to try to use this
> > format?
>
> I have always just used verified boot for U-Boot and the kernel, and
> only used vendor-specific stuff for SPL.
That indeed a good idea but CONFIG_SPL_FIT_SIGNATURE and CONFIG_SPL_DM (as
dependency) take a lot of space and SPL overflows i.MX6 OCRAM.
I finally succeed to make U-Boot check with HAB work using the new u-boot.itb
image with the following signature format:
------- +-----------------------------+ <-- *load_address
^ | |
| | |
| | Image data |
Signed | | |
Data | | |
| +-----------------------------+
| | Padding Next Boundary |
| +-----------------------------+ <-- *ivt
v | Image Vector Table |
------- +-----------------------------+ <-- *csf
| |
| Command Sequence File (CSF) |
| |
+-----------------------------+
| Padding (optional) |
+-----------------------------+
I don't really understand what u-boot-dtb.img file is but it doesn't work with
U-Boot CONFIG_IMX_HAB.
Thanks for help!
Benjamin
